Student engineer lends his hands to the future of auto cyber-security

Oct 15, 2012By Kaitor Kposowa and Colleen Carow

When you think of your car, words such as malware, cryptography and cyber-security probably don't come to mind – but they were constant concerns for one student at Ohio University's Fritz J. and Dolores H. Russ College of Engineering and Technology recently.

Matt Kennedy, a senior electrical engineering and computer science (EECS) student, was invited to the Battelle Memorial Institute CyberAuto Challenge in Aberdeen, Md., in late summer. The week was filled with courses, films, discussions and practical challenges associated with the future of transportation and how to combat potential threats.

"We learned about cyber security in multiple contexts, but with a major focus on how it relates to the automobile industry," Kennedy said. "Because all consumer vehicles manufactured today utilize robust internal electronic networks, the demand for cyber defense mechanisms is rapidly growing. This is especially critical with the integration of wireless communication embedded in vehicles."

Kennedy was recommended for the challenge by Bryan Riley, associate professor of EECS. As part of OHIO's Program to Aid Career Exploration (PACE), Kennedy works on Riley's Vehicle Modeling and Simulation Team, which has built a vehicle modeling and simulation buck (VMSB) -- a quarter-car physical driving assembly fabricated in a model shop from various parts and components -- to investigate safety features and simulate realistic driving scenarios.

"The opportunity for Matt to participate in an engineering program focused on working with passenger vehicles, instrumentation, and vehicle communication protocols really enriches his experience," Riley said.

The CyberAuto Challenge consisted of four cohorts, or teams, that engaged in a series of hands-on, real-world challenges as a means of learning, networking and possibly even influencing future decisions and policies. The cohorts were a mix of students, experts, and educators.

Karl Heimer, senior research director for cybersecurity at Battelle and founder of its Center for Advanced Vehicle Environments, says one of Battelle's core missions is to improve the next generation workforce.

"By having automotive engineers, government cyber-professionals, university and high school students, and independent security researchers working side-by-side on practical problems, we were able to generate the kinds of cross-talk and idea growth that will help excite all parties and lead to new ways of thinking about defensive security techniques," he said.
Kennedy explained that each day, the cohorts heard lectures on different cyber security topics followed by "car time," when they implemented what they learned on a real vehicle.

"Some of the lecture topics included tutorials on monitoring the Controller Area Network (CAN-BUS) network traffic, transmitting our own CAN messages, general security offensive and defensive techniques, computer forensics, and developing an awareness of the need for secure systems," he said. "As an exercise of this knowledge we attempted to reverse engineer CAN-BUS protocols of the electronic networks in modern commercial vehicles."

Reverse engineering is the process of understanding a device or system design by disassembling and analyzing its architecture. A CAN-BUS, or "controller area network" bus, is an electronic networking system most frequently used in vehicles. It enables the various electronics in a car, such as the engine, transmission, radio, infotainment systems, doors, etc., to communicate with each other.

In a set of challenges on the final night, the team had to call upon everything they'd learned.

"Each team was provided a car, and we were allowed to do whatever we liked with the CAN-BUS network. Our goal was to learn how we could manipulate the vehicle from a computer, for example, flashing the lights," Kennedy said. "Many of us were up as late as 4 a.m."

Now, Kennedy, Riley and team await news from the U.S. Department of Transportation- Federal Transit Administration on a proposal they submitted to conduct research using their VMSB.

"We would develop a pedestrian warning system that could be mounted on public transportation buses," Kennedy said. "With the VMSB, we can study vehicle collision avoidance, autonomous vehicle manuvers, driver and pedestrian alert systems, driver behavioral analysis and much more."

Kennedy called his experiences rare, while Riley noted that for him, it's just part of the job as a faculty member.

"Because the Russ College and PACE are dedicated to provide students with experiences that prepare them for the 'working' world upon graduation, part of my role is to provide Matt with this exposure," Riley said.